relay-companion 0.1.20 → 0.1.22

package/bin/relay.js

@@ -11,6 +11,7 @@ import { writeConfig, readConfig, apiUrl, DEFAULT_API_URL, DEFAULT_WEB_URL } fro
 import { runTaskDaemon, pollTaskRuntimeOnce } from "../src/task-daemon.js";
 import { runMcpServer } from "../src/mcp.js";
 import { runSetupInstall, runUninstall } from "../src/install.js";
+import { runUpdateOnce } from "../src/auto-update.js";
 import { liveToolRequirement, requiredLiveHosts, shouldRequireLiveTools } from "../src/setup-activation.js";
 import { openRelay, openTask } from "../src/materializer.js";
 import { resetCompanionStateForAccount } from "../src/notifications.js";
@@ -311,6 +312,9 @@ async function main() {
       return cmdPill();
     case "mcp":
       return runMcpServer();
+    case "update":
+    case "self-update":
+      return runUpdateOnce().then(() => {});
     default:
       console.log(
         [
@@ -331,6 +335,7 @@ async function main() {
           "  relay daemon [--interval MS]                          Run the task runtime daemon",
           "  relay pill                                            Launch the desktop Relay companion pill",
           "  relay mcp                                             Run the MCP server (for your agent)",
+          "  relay update                                          Update to the latest published companion and restart",
           "  relay whoami                                          Show the paired account",
         ].join("\n"),
       );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "relay-companion",
-  "version": "0.1.20",
+  "version": "0.1.22",
   "description": "Relay companion: connects local coding agents to Relay tasks, approvals, and connector tools.",
   "type": "module",
   "bin": {

package/src/auto-update.js

@@ -0,0 +1,275 @@
+// Companion self-update.
+//
+// The companion ships as an npm package (`relay-companion`) run by two launchd
+// agents (work.relay.companion = daemon, work.relay.companion.pill = overlay),
+// both pointing at ABSOLUTE paths inside the global install. Publishing a new
+// version to npm is the production deploy — but nothing pulled it onto users'
+// machines, so a click-routing fix (or any fix) only reached people who manually
+// re-ran `npm i -g relay-companion@latest`.
+//
+// This closes that loop: the daemon (the single always-on owner, kept alive by
+// launchd KeepAlive) periodically asks the npm registry for the latest published
+// version and, when it is newer than the running one, runs `npm i -g
+// relay-companion@latest` and restarts both launchd services. `npm i -g` overwrites
+// the same install directory in place, so the plists' absolute paths stay valid and
+// `launchctl kickstart -k` relaunches with the new code.
+//
+// Bootstrap caveat: a machine only auto-updates once it is already running a build
+// that CONTAINS this updater. Older installs still need one manual update to opt in.
+
+import os from "node:os";
+import path from "node:path";
+import fs from "node:fs";
+import { spawn } from "node:child_process";
+import { fileURLToPath } from "node:url";
+
+export const PACKAGE_NAME = "relay-companion";
+const DAEMON_LABEL = "work.relay.companion";
+const PILL_LABEL = "work.relay.companion.pill";
+const DEFAULT_REGISTRY = "https://registry.npmjs.org";
+const DEFAULT_CHECK_INTERVAL_MS = 30 * 60 * 1000; // poll the registry at most every 30 min
+const RETRY_COOLDOWN_MS = 30 * 60 * 1000; // if an update was launched but we're still alive, wait before retrying
+
+// ---- pure, unit-tested helpers ------------------------------------------
+
+// Parse "x.y.z" (tolerating a leading v and any build/prerelease suffix) into
+// numeric parts, or null if it doesn't look like a release version.
+export function parseVersion(v) {
+  const m = /^\s*v?(\d+)\.(\d+)\.(\d+)/.exec(String(v || ""));
+  return m ? [Number(m[1]), Number(m[2]), Number(m[3])] : null;
+}
+
+// True iff `candidate` is a strictly higher release than `current`. Conservative:
+// any unparseable input returns false, so a garbage registry reply never triggers
+// an update. Numeric-per-component so 0.1.10 correctly beats 0.1.9.
+export function isNewerVersion(candidate, current) {
+  const a = parseVersion(candidate);
+  const b = parseVersion(current);
+  if (!a || !b) return false;
+  for (let i = 0; i < 3; i += 1) {
+    if (a[i] > b[i]) return true;
+    if (a[i] < b[i]) return false;
+  }
+  return false;
+}
+
+export function latestFromRegistryDoc(doc) {
+  const latest = doc && doc["dist-tags"] && doc["dist-tags"].latest;
+  return typeof latest === "string" && latest ? latest : null;
+}
+
+// Only ever self-update a globally npm-installed copy. A dev checkout lives at
+// .../packages/companion (NOT under node_modules), so `npm i -g` would install a
+// SEPARATE global copy the plists don't point at — clobbering nothing useful and
+// confusing the developer. Guard against that.
+export function isManagedInstall(packageRoot) {
+  return /[\\/]node_modules[\\/]relay-companion[\\/]?$/.test(String(packageRoot || ""));
+}
+
+export function autoUpdateEnabled(env = process.env) {
+  const raw = String(env.RELAY_AUTO_UPDATE ?? "").trim().toLowerCase();
+  return !(raw === "0" || raw === "false" || raw === "off" || raw === "no");
+}
+
+// ---- environment probes -------------------------------------------------
+
+function moduleDir() {
+  return path.dirname(fileURLToPath(import.meta.url));
+}
+
+export function companionPackageRoot() {
+  return path.resolve(moduleDir(), "..");
+}
+
+export function currentCompanionVersion(packageRoot = companionPackageRoot()) {
+  try {
+    const pkg = JSON.parse(fs.readFileSync(path.join(packageRoot, "package.json"), "utf8"));
+    return typeof pkg.version === "string" ? pkg.version : null;
+  } catch {
+    return null;
+  }
+}
+
+// Ask the npm registry for the current `latest` dist-tag using the lightweight
+// abbreviated-metadata document. Returns the version string, or null on any error
+// (offline, timeout, unexpected shape) so the caller simply skips this cycle.
+export async function fetchLatestVersion({
+  fetchImpl = globalThis.fetch,
+  timeoutMs = 10_000,
+  registry = DEFAULT_REGISTRY,
+} = {}) {
+  if (typeof fetchImpl !== "function") return null;
+  try {
+    const res = await fetchImpl(`${registry}/${PACKAGE_NAME}`, {
+      headers: { Accept: "application/vnd.npm.install-v1+json" },
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+    if (!res || !res.ok) return null;
+    return latestFromRegistryDoc(await res.json());
+  } catch {
+    return null;
+  }
+}
+
+// ---- update execution ---------------------------------------------------
+
+function updateLogPath() {
+  return path.join(os.homedir(), ".relay", "update.log");
+}
+
+// Launch the install + restart in a FULLY DETACHED shell (its own session via
+// `detached`), so it survives the daemon being killed when we restart it. The
+// script is hardened against the ways an unattended, in-place `npm i -g` can go
+// wrong on a fleet of machines:
+//   - Single-writer lock (mkdir, with stale-steal) so a manual `relay update` and
+//     the daemon can't run concurrent global installs into the same dir.
+//   - Verify the freshly-written tree is loadable (electron binary present + the
+//     bin + a valid package.json) BEFORE restarting anything, so a partial install
+//     — e.g. electron's postinstall binary download failing mid-way — is never
+//     launched. The pill plist hard-points at electron, so a broken tree would
+//     otherwise brick the pill on its next relaunch.
+//   - On install or verify failure, reinstall the CURRENT version to restore a
+//     known-good on-disk tree, then leave the running processes alone.
+//   - Restart the pill first and the daemon LAST — kicking the daemon SIGKILLs this
+//     process's parent, but this detached shell has already issued everything before
+//     that and launchd relaunches the daemon with the freshly installed code.
+export function spawnDetachedUpdate({
+  uid = typeof process.getuid === "function" ? process.getuid() : 0,
+  currentVersion = null,
+  logPath = updateLogPath(),
+  lockPath = path.join(os.homedir(), ".relay", "update.lock"),
+  spawnImpl = spawn,
+  log = () => {},
+  ensureDir = true,
+} = {}) {
+  if (ensureDir) {
+    try {
+      fs.mkdirSync(path.dirname(logPath), { recursive: true });
+    } catch {}
+  }
+  const q = (s) => `'${String(s).replaceAll("'", "'\\''")}'`; // safe single-quote for the shell
+  const LOG = q(logPath);
+  const LOCK = q(lockPath);
+  // Restore target if the new install is broken: reinstall the version we're running
+  // now so the on-disk tree stays loadable for the next launchd relaunch. Fall back
+  // to @latest only if we somehow don't know our own version.
+  const restore = parseVersion(currentVersion) ? currentVersion : "latest";
+  const script = [
+    `export PATH="/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:$PATH"`,
+    // Hold the lock path in a shell var and reference "$LOCK" everywhere so every use
+    // (including the single-quoted trap action) stays correct even if the home path
+    // contains a space — nesting the pre-quoted path inside the trap's own quotes would
+    // otherwise word-split and silently drop the EXIT trap, leaking the lock.
+    `LOCK=${LOCK}`,
+    `mkdir -p "$(dirname "$LOCK")" 2>/dev/null`,
+    // Steal a stale lock left by a crashed prior run (older than 20 min > any real install).
+    `if [ -d "$LOCK" ] && [ -n "$(find "$LOCK" -maxdepth 0 -mmin +20 2>/dev/null)" ]; then rmdir "$LOCK" 2>/dev/null; fi`,
+    // Single-writer: a second updater (manual \`relay update\`, or a daemon race) no-ops.
+    `if ! mkdir "$LOCK" 2>/dev/null; then echo "[relay-update] $(date) another update in progress; skipping" >> ${LOG} 2>&1; exit 0; fi`,
+    `trap 'rmdir "$LOCK" 2>/dev/null' EXIT INT TERM`,
+    `echo "[relay-update] $(date) installing ${PACKAGE_NAME}@latest (current ${restore})" >> ${LOG} 2>&1`,
+    `if npm install -g ${PACKAGE_NAME}@latest >> ${LOG} 2>&1; then`,
+    `  ROOT="$(npm root -g 2>/dev/null)"`,
+    `  PKG="$ROOT/${PACKAGE_NAME}"`,
+    `  ELECTRON="$PKG/node_modules/electron/dist/Electron.app/Contents/MacOS/Electron"`,
+    `  if [ -x "$ELECTRON" ] && [ -f "$PKG/bin/relay.js" ] && grep -q '"version"' "$PKG/package.json" 2>/dev/null; then`,
+    `    echo "[relay-update] $(date) install verified; restarting services" >> ${LOG} 2>&1`,
+    `    /bin/launchctl kickstart -k gui/${uid}/${PILL_LABEL} >> ${LOG} 2>&1 || true`,
+    `    /bin/launchctl kickstart -k gui/${uid}/${DAEMON_LABEL} >> ${LOG} 2>&1 || true`,
+    `  else`,
+    `    echo "[relay-update] $(date) post-install verify FAILED; restoring ${restore}" >> ${LOG} 2>&1`,
+    `    npm install -g ${PACKAGE_NAME}@${restore} >> ${LOG} 2>&1 || true`,
+    `  fi`,
+    `else`,
+    `  echo "[relay-update] $(date) install FAILED; restoring ${restore}" >> ${LOG} 2>&1`,
+    `  npm install -g ${PACKAGE_NAME}@${restore} >> ${LOG} 2>&1 || true`,
+    `fi`,
+  ].join("\n");
+  const child = spawnImpl("/bin/sh", ["-c", script], { detached: true, stdio: "ignore" });
+  // A detached child with NO 'error' listener turns an async spawn failure (EMFILE,
+  // EAGAIN, ENOENT on /bin/sh) into an unhandled 'error' that would crash this
+  // always-on daemon. Swallow it — the update simply doesn't happen this cycle.
+  if (child && typeof child.on === "function") {
+    child.on("error", (err) => log(`auto-update spawn error: ${err && err.message ? err.message : String(err)}`));
+  }
+  if (child && typeof child.unref === "function") child.unref();
+  return child;
+}
+
+// ---- orchestrator -------------------------------------------------------
+
+// Build a rate-limited auto-update checker. Call `tick()` freely (e.g. once per
+// daemon poll); it no-ops cheaply until a check is due, then fetches the latest
+// version and, if newer, launches the detached update-and-restart. Every effectful
+// dependency is injectable so the decision logic is unit-testable without network,
+// npm, or launchd. `tick()` never throws.
+export function createAutoUpdater({
+  now = () => Date.now(),
+  env = process.env,
+  packageRoot = companionPackageRoot(),
+  getCurrentVersion = () => currentCompanionVersion(packageRoot),
+  getLatestVersion = (opts) => fetchLatestVersion(opts),
+  spawnUpdate = (opts) => spawnDetachedUpdate(opts),
+  checkIntervalMs = Number(env.RELAY_UPDATE_CHECK_INTERVAL_MS) || DEFAULT_CHECK_INTERVAL_MS,
+  retryCooldownMs = RETRY_COOLDOWN_MS,
+  log = () => {},
+} = {}) {
+  const state = { lastCheckAt: 0, updateStartedAt: 0, updating: false };
+
+  async function tick() {
+    if (!autoUpdateEnabled(env)) return { status: "disabled" };
+    if (!isManagedInstall(packageRoot)) return { status: "unmanaged" };
+    const t = now();
+    // An update was launched but we're still alive (install failed, or restart is
+    // pending) — hold off re-triggering until the cooldown so we don't hammer npm.
+    if (state.updating && t - state.updateStartedAt < retryCooldownMs) return { status: "in-flight" };
+    if (state.lastCheckAt && t - state.lastCheckAt < checkIntervalMs) return { status: "not-due" };
+    state.lastCheckAt = t;
+
+    const current = getCurrentVersion();
+    const latest = await getLatestVersion();
+    if (!latest) return { status: "check-failed", current };
+    if (!isNewerVersion(latest, current)) return { status: "up-to-date", current, latest };
+
+    log(`auto-update: ${current} -> ${latest}; installing latest and restarting`);
+    state.updating = true;
+    state.updateStartedAt = t;
+    try {
+      spawnUpdate({ log, currentVersion: current });
+    } catch (err) {
+      state.updating = false;
+      log(`auto-update launch failed: ${err && err.message ? err.message : String(err)}`);
+      return { status: "launch-failed", current, latest };
+    }
+    return { status: "updating", current, latest };
+  }
+
+  return { tick, state };
+}
+
+// One-shot for the `relay update` CLI: check once and, if a newer version exists,
+// launch the update. Prints a human-readable line. Bypasses the interval gate.
+export async function runUpdateOnce({ log = (m) => console.log(`[relay] ${m}`) } = {}) {
+  const updater = createAutoUpdater({ checkIntervalMs: 0, log });
+  const result = await updater.tick();
+  switch (result.status) {
+    case "updating":
+      log(`updating ${result.current} -> ${result.latest}; the pill and daemon will restart shortly.`);
+      break;
+    case "up-to-date":
+      log(`already on the latest version (${result.current}).`);
+      break;
+    case "unmanaged":
+      log("not a global npm install (dev checkout?) — skipping self-update.");
+      break;
+    case "disabled":
+      log("auto-update is disabled (RELAY_AUTO_UPDATE).");
+      break;
+    case "check-failed":
+      log("could not reach the npm registry to check for updates.");
+      break;
+    default:
+      log(`update check: ${result.status}`);
+  }
+  return result;
+}

package/src/codex-desktop.js

@@ -78,87 +78,110 @@ export async function notifyCodexDesktopThreads({
   return { attempted: true, ok: results.some((result) => result.ok), results };
 }
 
-export function buildCodexDesktopRefreshExpression({ threadIds = [], pinnedThreadIds = null, openThreadId = null } = {}) {
-  const rendererCode = `(${async function relayRefreshCodexRenderer(payload) {
-    const hostId = "local";
-    const bridge = window.electronBridge;
-    if (!bridge?.sendMessageFromView) return { ok: false, reason: "missing-electron-bridge" };
+// Runs INSIDE each Codex renderer: it is serialized to a string via toString()
+// and evaluated in the window's page context, so it must be self-contained — no
+// imports, only renderer globals (window, location). Exported at module scope so
+// the thread-routing decision can be unit-tested directly.
+export async function relayRefreshCodexRenderer(payload) {
+  const hostId = "local";
+  const bridge = window.electronBridge;
+  if (!bridge?.sendMessageFromView) return { ok: false, reason: "missing-electron-bridge" };
 
-    const sent = [];
-    async function send(message) {
-      try {
-        await bridge.sendMessageFromView(message);
-        sent.push({ type: message.type, ok: true });
-      } catch (error) {
-        sent.push({ type: message.type, ok: false, error: String(error?.message || error) });
-      }
+  const sent = [];
+  async function send(message) {
+    try {
+      await bridge.sendMessageFromView(message);
+      sent.push({ type: message.type, ok: true });
+    } catch (error) {
+      sent.push({ type: message.type, ok: false, error: String(error?.message || error) });
     }
+  }
 
-    if (Array.isArray(payload.pinnedThreadIds)) {
-      await send({ type: "set-pinned-thread-ids-for-host", hostId, threadIds: payload.pinnedThreadIds });
-    }
-    if (payload.threadIds.length) {
-      await send({ type: "hydrate-pinned-threads", hostId, threadIds: payload.threadIds });
-    }
-    await send({ type: "refresh-recent-conversations-for-host", hostId });
-    for (const threadId of payload.threadIds) {
-      // Codex Desktop (>=0.142) serves thread views from its in-memory core and
-      // never cold-loads externally created threads — the view spins forever
-      // until an app restart. Adopt the thread the way the app itself opens one:
-      // drop any stale cache entry, ask the tail-hydration path to load history
-      // (feature-gated; harmless when off — dependentConversationIds is REQUIRED
-      // or the handler throws), then maybe-resume-conversation, which activates
-      // the thread summary and resumes the conversation from the rollout on disk.
-      await send({ type: "discard-conversation-from-cache", conversationId: threadId });
-      await send({ type: "ensure-conversation-history-loaded", conversationId: threadId, dependentConversationIds: [] });
-      await send({
-        type: "maybe-resume-conversation",
-        hostId,
-        conversationId: threadId,
-        model: null,
-        serviceTier: null,
-        reasoningEffort: null,
-        workspaceRoots: [],
-        collaborationMode: null,
-      });
-      await send({ type: "broadcast-conversation-snapshot-for-host", hostId, conversationId: threadId });
-    }
-    if (payload.openThreadId) {
-      try {
-        window.postMessage(
-          {
-            type: "navigate-to-route",
-            path: `/hotkey-window/thread/${encodeURIComponent(String(payload.openThreadId))}`,
-          },
-          location.origin,
-        );
-        sent.push({ type: "navigate-to-route", ok: true, threadId: payload.openThreadId });
-      } catch (error) {
-        sent.push({ type: "navigate-to-route", ok: false, error: String(error?.message || error) });
-      }
+  if (Array.isArray(payload.pinnedThreadIds)) {
+    await send({ type: "set-pinned-thread-ids-for-host", hostId, threadIds: payload.pinnedThreadIds });
+  }
+  if (payload.threadIds.length) {
+    await send({ type: "hydrate-pinned-threads", hostId, threadIds: payload.threadIds });
+  }
+  await send({ type: "refresh-recent-conversations-for-host", hostId });
+  for (const threadId of payload.threadIds) {
+    // Codex Desktop (>=0.142) serves thread views from its in-memory core and
+    // never cold-loads externally created threads — the view spins forever
+    // until an app restart. Adopt the thread the way the app itself opens one:
+    // drop any stale cache entry, ask the tail-hydration path to load history
+    // (feature-gated; harmless when off — dependentConversationIds is REQUIRED
+    // or the handler throws), then maybe-resume-conversation, which activates
+    // the thread summary and resumes the conversation from the rollout on disk.
+    await send({ type: "discard-conversation-from-cache", conversationId: threadId });
+    await send({ type: "ensure-conversation-history-loaded", conversationId: threadId, dependentConversationIds: [] });
+    await send({
+      type: "maybe-resume-conversation",
+      hostId,
+      conversationId: threadId,
+      model: null,
+      serviceTier: null,
+      reasoningEffort: null,
+      workspaceRoots: [],
+      collaborationMode: null,
+    });
+    await send({ type: "broadcast-conversation-snapshot-for-host", hostId, conversationId: threadId });
+  }
+  if (payload.openThreadId) {
+    try {
+      const encoded = encodeURIComponent(String(payload.openThreadId));
+      // Codex renders a thread through two separate router surfaces: the main
+      // window (sidebar + recents rail) at /local/<id>, and the borderless hotkey
+      // "quick chat" overlay at /hotkey-window/thread/<id>. The app's own
+      // navigation chooses between them by whether the current window is the
+      // hotkey one (its QH() keys off location.pathname). Mirror that here so the
+      // thread opens in whichever surface the user is actually in — otherwise
+      // every open is forced into the overlay even when the main window is up.
+      const path = location.pathname.startsWith("/hotkey-window")
+        ? `/hotkey-window/thread/${encoded}`
+        : `/local/${encoded}`;
+      window.postMessage({ type: "navigate-to-route", path }, location.origin);
+      sent.push({ type: "navigate-to-route", ok: true, threadId: payload.openThreadId, path });
+    } catch (error) {
+      sent.push({ type: "navigate-to-route", ok: false, error: String(error?.message || error) });
     }
+  }
+
+  return { ok: sent.some((item) => item.ok), href: location.href, openThreadId: payload.openThreadId || null, sent };
+}
 
-    return { ok: sent.some((item) => item.ok), href: location.href, openThreadId: payload.openThreadId || null, sent };
-  }.toString()})(${JSON.stringify({
+export function buildCodexDesktopRefreshExpression({ threadIds = [], pinnedThreadIds = null, openThreadId = null } = {}) {
+  const rendererCode = `(${relayRefreshCodexRenderer.toString()})(${JSON.stringify({
     threadIds: uniqueStrings(threadIds),
     pinnedThreadIds,
     openThreadId: String(openThreadId || "").trim() || null,
   })})`;
+  // Only bring a window forward when we're actually opening a thread.
+  const wantsFocus = Boolean(String(openThreadId || "").trim());
 
   return `(async () => {
     const req = process.mainModule?.require || process.getBuiltinModule("module").createRequire(process.cwd() + "/");
     const { BrowserWindow } = req("electron");
     const code = ${JSON.stringify(rendererCode)};
+    const wantsFocus = ${JSON.stringify(wantsFocus)};
     const windows = [];
     for (const win of BrowserWindow.getAllWindows()) {
       if (win.isDestroyed()) continue;
       try {
-        windows.push({
-          id: win.id,
-          visible: win.isVisible(),
-          url: win.webContents.getURL(),
-          result: await win.webContents.executeJavaScript(code, true),
-        });
+        const url = win.webContents.getURL();
+        const result = await win.webContents.executeJavaScript(code, true);
+        // Bring the main window forward after navigating it to the thread, the way
+        // Codex's own restoreShowAndFocusWindow does. The hotkey overlay manages
+        // its own visibility, so leave it alone and only surface the main window.
+        let focused = false;
+        if (wantsFocus && !String(url || "").includes("/hotkey-window")) {
+          try {
+            if (win.isMinimized()) win.restore();
+            win.show();
+            win.focus();
+            focused = true;
+          } catch {}
+        }
+        windows.push({ id: win.id, visible: win.isVisible(), url, focused, result });
       } catch (error) {
         windows.push({ id: win.id, ok: false, error: String(error?.message || error) });
       }

package/src/task-daemon.js

@@ -16,6 +16,7 @@ import {
   reconcileAnsweredQuestions,
   stagePlainRelayItem as defaultStagePlainRelayItem,
 } from "./notifications.js";
+import { createAutoUpdater } from "./auto-update.js";
 
 function idempotencyKey(prefix) {
   return `${prefix}_${randomUUID()}`;
@@ -262,7 +263,26 @@ export async function runTaskDaemon({ intervalMs = 4000 } = {}) {
   console.log(`[relay] task runtime for ${me.user.email}; polling every ${intervalMs}ms`);
   // eslint-disable-next-line no-console
   const log = (m) => console.log(`[relay] ${m}`);
+  // Keep this machine current with production: the daemon is the always-on owner, so
+  // it (not the pill) checks npm for a newer companion and self-updates. Rate-limited
+  // internally, so calling it every loop is cheap; a real check hits the network at
+  // most every ~30 min. Never throws.
+  const autoUpdater = createAutoUpdater({ log });
   for (;;) {
+    // Fire-and-forget: tick() rate-limits itself and never rejects, and task polling
+    // must NOT block on a registry fetch (a black-holed socket could stall it ~10s).
+    // The internal lastCheckAt/in-flight guards prevent overlapping checks or installs.
+    autoUpdater
+      .tick()
+      .then((update) => {
+        if (update.status === "updating") {
+          log(`self-update launched (${update.current} -> ${update.latest}); restarting shortly`);
+        } else if (update.status === "launch-failed") {
+          log(`self-update launch failed for ${update.current} -> ${update.latest}`);
+        }
+      })
+      // eslint-disable-next-line no-console
+      .catch((err) => console.error(`[relay] auto-update check error: ${err && err.message ? err.message : err}`));
     try {
       const result = await pollTaskRuntimeOnce({ client, log });
       if (